647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762 | @pytest.mark.repricing
@pytest.mark.parametrize("num_pairs", [1, 3, 6, 12, 24])
def test_ec_pairing(
benchmark_test: BenchmarkTestFiller,
pre: Alloc,
fork: Fork,
gas_benchmark_value: int,
tx_gas_limit: int,
num_pairs: int,
) -> None:
"""Benchmark ecpairing precompile with unique inputs per call."""
pair_size = num_pairs * 192
gsc = fork.gas_costs()
intrinsic_gas_calculator = fork.transaction_intrinsic_cost_calculator()
mem_exp = fork.memory_expansion_gas_calculator()
precompile_cost = (
gsc.PRECOMPILE_ECPAIRING_BASE
+ gsc.PRECOMPILE_ECPAIRING_PER_POINT * num_pairs
)
# Each iteration: STATICCALL ecpairing at advancing calldata offset,
# then advance offset by pair_size at memory[CALLDATASIZE].
# The loop condition checks remaining gas against one body execution.
attack_block = Op.POP(
Op.STATICCALL(
gas=Op.GAS,
address=EIP197Spec.ECPAIRING,
args_offset=Op.MLOAD(Op.CALLDATASIZE),
args_size=pair_size,
# gas accounting
address_warm=True,
inner_call_cost=precompile_cost,
),
) + Op.MSTORE(
Op.CALLDATASIZE,
Op.ADD(Op.MLOAD(Op.CALLDATASIZE), pair_size),
)
setup = Op.CALLDATACOPY(0, 0, Op.CALLDATASIZE)
loop = While(
body=attack_block,
condition=Op.GT(Op.CALLDATASIZE, Op.MLOAD(Op.CALLDATASIZE)),
)
code = setup + loop
attack_contract_address = pre.deploy_contract(code=code)
iteration_cost = loop.gas_cost(fork)
setup_cost = setup.gas_cost(fork)
# Conservative per-variant estimate for sizing the calldata:
# one loop iteration + worst-case calldata intrinsic (all non-zero)
# + CALLDATACOPY copy and linear memory expansion.
words_per_variant = math.ceil(pair_size / 32)
per_variant_gas = (
iteration_cost
+ pair_size * 16
+ words_per_variant * (gsc.OPCODE_COPY_PER_WORD + gsc.MEMORY_PER_WORD)
)
empty_intrinsic = intrinsic_gas_calculator(
calldata=[], return_cost_deducted_prior_execution=True
)
fixed_overhead = empty_intrinsic + setup_cost + mem_exp(new_bytes=32)
seed_offset = 0
txs: list[Transaction] = []
remaining_gas = gas_benchmark_value
expected_opcode_count = 0
while remaining_gas > 0:
per_tx_gas = min(tx_gas_limit, remaining_gas)
per_tx_variants = max(
1, (per_tx_gas - fixed_overhead) // per_variant_gas
)
calldata = Bytes(
b"".join(
_generate_bn128_pairs(num_pairs, seed=42 + seed_offset + i)
for i in range(per_tx_variants)
)
)
execution_intrinsic = intrinsic_gas_calculator(
calldata=calldata,
return_cost_deducted_prior_execution=True,
)
gas_for_loop = (
per_tx_gas
- execution_intrinsic
- setup_cost
- math.ceil(len(calldata) / 32) * gsc.OPCODE_COPY_PER_WORD
- mem_exp(new_bytes=len(calldata) + 32)
)
if gas_for_loop < per_tx_variants * iteration_cost:
break
expected_opcode_count += per_tx_variants
txs.append(
Transaction(
to=attack_contract_address,
sender=pre.fund_eoa(),
gas_limit=per_tx_gas,
data=calldata,
)
)
remaining_gas -= per_tx_gas
seed_offset += per_tx_variants
assert len(txs) != 0, "No transactions were added to the test."
benchmark_test(
target_opcode=Precompile.BN128_PAIRING,
skip_gas_used_validation=True,
expected_receipt_status=1,
expected_opcode_count=expected_opcode_count,
blocks=[Block(txs=txs)],
)
|